Executive brief
LangChain is a popular Python library for building applications with large language models (LLMs). The PALChain component, which combines LLMs with Python code execution to solve reasoning tasks, accepts user prompts that can be manipulated to inject malicious code. An attacker can craft a prompt containing commands (like `import os`) that get executed by the Python `exec()` function without sanitization, allowing arbitrary code execution on systems running vulnerable versions of LangChain.
Technical details
The vulnerability is a code injection flaw (CWE-94) in LangChain's PALChain, which uses the Python `exec()` method to execute code generated by the LLM. An attacker can inject malicious commands through user-supplied prompts that are passed to the LLM; the generated code containing these injected commands is then executed without sanitization. The attack vector is network/user-supplied input with no authentication required. Exploitation allows arbitrary code execution with the privileges of the application process. Multiple patches have been released (versions 0.0.247 and later), and mitigation PRs added input validation and safer code execution constraints.
Affected products
- LangChain LangChain before 0.0.247
Timeline
- 2023-06-08: disclosed: Issue reported on GitHub
- 2023-07-03: advisory: GHSA-2qmj-7962-cjq8 published
- 2023-07-03: patched: Fix released in version 0.0.247